#!/usr/bin/perl

#use strict;
#use warnings;

use POSIX qw(strftime);
use Data::Dumper;
use Time::Local;
use Time::HiRes qw(gettimeofday);

my $basedir = '/logcheck/etc';
my $log_takeoff_level2 = "$basedir/tmp/check";
my $outdir  = "$basedir/migrate";
mkdir $outdir if ! -d $outdir;
my $date = strftime "%Y-%m-%d", localtime;
my $hourdate = strftime "%Y-%m-%d-%H", localtime;
my ($start_sec, $start_usec) = gettimeofday;
my $servername = `hostname -s`; chomp $servername;
my $hash; my %hash;
my @content_other;
my %hashIP;
my %priority=(7=>"debug", 6=>"info", 5=>"notice", 4=>"warning", 3=>"err", 2=>"crit", 1=>"alert", 0=>"emerg");
my $configdir="/logcheck/etc/config";
require("$configdir/iswitch-ports");
#print join(',',@SWITCH);
#require("$configdir/db_mysql.pl");
require("$configdir/conndb");
my $dbh=&connect();
$dbh->do(qq{set names 'gbk'});

# set report address
# change this!
my $mailDM='fetionyy.com.cn';
my $SYSADMIN="changfugang@$mailDM liweixin@$mailDM hanhuihui@$mailDM hanjianye@$mailDM yuyongxin@$mailDM daixianglong@$mailDM lihanf
u@$mailDM tangguoriu@$mailDM";
#my $SYSADMIN='changfugang@'.$mailDM;

#set keywords
#=====================================================================================
 ##denied
 #e.g. Denied ICMP
 ##Invalid    
 #e.g. Invalid transport field
 ##Deny
 #Deny inbound;Deny * src
 ##[Pp]ower
 #e.g. Power supply 1 output has dropped
 ##[Cc]onfigur
 #e.g. Beginning configuration replication;Configured from console by impsadmin onvty0
#=====================================================================================
#change this
my @A10_keywords=("NTP","[Uu]ser","Session","Service tcp","SLB server");
my @F5_keywords=("NTP","[Uu]ser","Session","HTTP","mysql","syslog-ng","crond","httpd","sshd","anacron","mcpd");
my @Alteon_keywords=("mgmt");
my @FW_keywords=("[Dd]enied","Deny","Invalid","[Pp]ower","[Cc]onfigur");
my @SR_keywords=("[Cc]onfigur","SHELL","CMD","SSH","SNMP","TELNET","VTY","Trap","OID","admin");
my @Nokia_keywords=("BACKUP_RESTORE_CONFIG","snmpd","repeated","telnetd","syslogd","CONFIG","ntpdate","cron:","ipsctl get error","login");
my @All_keywords=(@A10_keywords,@F5_keywords,@Alteon_keywords,@FW_keywords,@SR_keywords,@Nokia_keywords);
my %Hash_All_keywords;
while(@All_keywords) {
    my $keyword = shift @All_keywords;
    $Hash_All_keywords{$keyword} = 1;
}

my @FW_syslog=();
my @SR_syslog=();
my @Alteon_syslog=();
my @F5_syslog=();
my @Other_syslog=();
my @A10_syslog=();

my $logtaildir = "$basedir/tmp/logtail";
mkdir $logtaildir if ! -d $logtaildir;
my @filename = ();
opendir ( DIR, "$logtaildir" ) || die "Error in opening dir $logtaildir\n";
while( (my $file = readdir(DIR))){
   if ( $file =~ /messages_$date$/ ){
        push(@filename,"$file");
   }
}
closedir(DIR);

my @totalline;
for (my $i=0;$i<@filename;$i++){
        my $filename = $filename[$i];
        my $logfile = "$logtaildir/$filename";
	my ($hostname,$counts)=&scheduler($logfile);
	push(@totalline,"$hostname $counts") if ($hostname ne 'NULL' or $counts ne 'NULL');
}

my $realcounts = 0;
if (@totalline > 0){
    foreach my $i (@totalline){
	my ($hostname,$counts) = split(/\s+/,$i);
	$realcounts += $counts;
    }
}
print 'Real servers(include the server of inner filter): '.scalar(@totalline)."\n";
print 'Real Counts(include the counts of inner filter): '.$realcounts."\n";
#print join("\n",@totalline)."\n";

my $log_total = &analyze();

my $MailFlag = 0;
my $MailSubject = "${servername}_${date}_[analysis of syslog]";
my $MailContent_other = '';
my $MailContent="BEGIN REPORT\n";
$MailContent.="------------------------------\n";
$MailContent.="Syslog Report on $servername\n";
$MailContent.="=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n";

$MailContent .= &FireWall_echo() if @FW_syslog > 0;
$MailContent .= &undefined_echo() if @content_other > 0;

$MailContent .= "\n".$log_total.".undefined syslog records were found.\n"; 
$MailContent .= $realcounts.".syslog records were analyzed.\n"; 

my ($end_sec, $end_usec) = gettimeofday;
my $time_used = ($end_sec - $start_sec) + ($end_usec - $start_usec)/1000000;
$time_used = &conv_date_tostr($time_used);
$MailContent .= "$time_used\n";

$MailContent .= "END OF REPORT\n";
print $MailContent."\n";

#&sendmail($SYSADMIN,$MailFlag,$MailSubject,$MailContent);

sub scheduler
{
        my $logfile = shift;
        my $hostname; my $IP; my $host; my $template;
        open(FID, "<$logfile") or die "can't open file $logfile";
        my $line=<FID>;
        chomp $line;
        if ( !defined $line or $line eq '' ){
            $hostname = "FALSE";
        }elsif ( $line !~ /^[A-Z][a-z]{2}\s+\d{1,2}\s+\d{2}:\d{2}:\d{2}\s+\w+/ ) {
            $hostname = "FALSE";
            open(JUNK, ">> $outdir/badly_formatted_logs");
            print JUNK "$line\n";
            close JUNK;
        }else{
            $IP = (split(/\s+/,$line))[3];
	    if ( $IP =~ /\// ){
		$host = (split(/\//,$IP))[0];
	        $IP = (split(/\//,$IP))[1];
	    }else{
		$host = $IP;
	    }

            if ($host !~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/ ){
                $hostname = $host;
            }else{
                if ( $line =~ /(.*?)\s+(\w+(-\w+){1,4})\s+(.*?):/ ) {
                    $hostname="$2";
                }else{
                    $hostname=$host;
                }
            }
        }

	if ( $hostname !~ /FALSE/ ) {
            open(HOST, "> $outdir/ip_$hostname");
            print HOST "$hostname\t$IP\n";
            close HOST;
	}

        if ($hostname =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/ ){
            $template = "A10" if $line =~ m/a10logd:/;
            $template = "FW" if $line =~ m/FWSM-|PIX-|NetScreen/;
            $template = "Alteon" if $line =~ m/AlteonOS/;
            $template = "F5" if $line =~ m/F5/;
        }else{
            $template = $hostname;
        }

        if ( $template =~ /FALSE/ ) {
            return ('NULL','NULL');
        }elsif( $template =~ /FW|^NS|^pix|PIX/ ) {
            print "FireWall: $hostname\t$IP\n";
            my $counts = &FireWall($IP,$hostname,$logfile);
            return ($hostname,$counts);
        }elsif( $template =~ /^S|^C|^NE|8500|[_-]S93|[_-]S85|[_-]NE|[_-]9512/ ) {
            print "Switch and Router: $hostname\t$IP\n";
            my $counts = &Switch_Router($IP,$hostname,$logfile);
            return ($hostname,$counts);
        }elsif( $template =~/A10/ ) {
            print "A10: $hostname\t$IP\n";
            my $counts = &A10($IP,$hostname,$logfile);
            return ($hostname,$counts);
        }elsif( $template =~/F5/ ) {
            print "F5: $hostname\t$IP\n";
            my $counts = &F5($IP,$hostname,$logfile);
            return ($hostname,$counts);
        }elsif( $template =~/A3408|Alteon/ ) {
            print "Alteon: $hostname\t$IP\n";
            my $counts = &Alteon($IP,$hostname,$logfile);
            return ($hostname,$counts);
        }else{
            print "Otherhost: $hostname\t$IP\n";
            my $counts = &Otherone($IP,$hostname,$logfile);
            return ($hostname,$counts);
        }
}

sub analyze
{
        if (scalar(@FW_syslog)>0){
            for ( my $i=0;$i<@FW_syslog;$i++) {
               my $value = $FW_syslog[$i];
               my ($timelist,$host,$IP,$program,$level,$content)=split(/\,/,$value);
               my $loggentime=(split(/\s+/,$timelist))[2];
               my $ckey;
               my $isckey=0;

               for (my $i=0;$i<@FW_keywords;$i++){
                    $ckey = $FW_keywords[$i];
                    if ($program =~ m/$ckey/ || $content =~ m/$ckey/){
                        $isckey = 1;
                        last;
                    }
               }

               $ckey = 'other' if $isckey==0;

               $content =~ m/.*(\d+\.\d+\.\d+\.\d+).*[\s:]+(\d+\.\d+\.\d+\.\d+).*/;
               my $ourIP = $2;
               if (defined $ourIP && $ourIP ne '') {
                   if( exists( $hashIP{"${host}_${ckey}_$ourIP"} ) )
                   {
                           $hashIP{"${host}_${ckey}_$ourIP"} += 1;
                   }
                   else
                   {
                           $hashIP{"${host}_${ckey}_$ourIP"} = 1;
                   }
               }

               if( exists( $hash->{"${host}_$IP"}{$level}{$ckey} ) )
               {
                       $hash->{"${host}_$IP"}{$level}{$ckey} += 1;
                       if ($ckey eq 'other'){
                            push(@content_other,"$loggentime,$host,$IP,$program,$level,$content");
                       }
               }
               else
               {
                       $hash->{"${host}_$IP"}{$level}{$ckey} = 1;
                       if ($ckey eq 'other'){
                            push(@content_other,"$loggentime,$host,$IP,$program,$level,$content");
                       }
               }

            }
        }

        if (scalar(@SR_syslog)>0){
            for ( my $i=0;$i<@SR_syslog;$i++) {
               my $value = $SR_syslog[$i];
               my ($timelist,$host,$IP,$program,$level,$content)=split(/\,/,$value);
               my $loggentime=(split(/\s+/,$timelist))[2];
               my $ckey;
               my $isckey=0;

               for (my $i=0;$i<@SR_keywords;$i++){
                    $ckey = $SR_keywords[$i];
                    if ($program =~ m/$ckey/ || $content =~ m/$ckey/){
                        $isckey = 1;
                        last;
                    }
               }

               $ckey = 'other' if $isckey==0;

               if ($ckey eq 'other'){
                    my $swport = &SW_addition($host,$content);
                    #print "swport: $swport\n";
                    if ($swport == 1){
			push(@content_other,"$loggentime,$host,$IP,$program,$level,$content");
                    }else{
                        open(SWPORT, ">>$outdir/swport_${host}_$hourdate");
                        print SWPORT "$host,$IP,$program,$level,$content\n";
                        close SWPORT;
                    }
               }

            }
        }

        if (scalar(@F5_syslog)>0){
            for ( my $i=0;$i<@F5_syslog;$i++) {
               my $value = $F5_syslog[$i];
               my ($timelist,$host,$IP,$program,$level,$content)=split(/\,/,$value);
               my $loggentime=(split(/\s+/,$timelist))[2];
               my $ckey;
               my $isckey=0;

               for (my $i=0;$i<@F5_keywords;$i++){
                    $ckey = $F5_keywords[$i];
                    if ($program =~ m/$ckey/ || $content =~ m/$ckey/){
                        $isckey = 1;
                        last;
                    }
               }

               $ckey = 'other' if $isckey==0;

               if ($ckey eq 'other'){
                    push(@content_other,"$loggentime,$host,$IP,$program,$level,$content");
               }
            }
        }

        if (scalar(@A10_syslog)>0){
            for ( my $i=0;$i<@A10_syslog;$i++) {
               my $value = $A10_syslog[$i];
               my ($timelist,$host,$IP,$program,$level,$content)=split(/\,/,$value);
               my $loggentime=(split(/\s+/,$timelist))[2];
               my $ckey;
               my $isckey=0;

               for (my $i=0;$i<@A10_keywords;$i++){
                    $ckey = $A10_keywords[$i];
                    if ($program =~ m/$ckey/ || $content =~ m/$ckey/){
                        $isckey = 1;
                        last;
                    }
               }

               $ckey = 'other' if $isckey==0;

               if ($ckey eq 'other'){
                    push(@content_other,"$loggentime,$host,$IP,$program,$level,$content");
               }
            }
        }

        if (scalar(@Alteon_syslog)>0){
            for ( my $i=0;$i<@Alteon_syslog;$i++) {
               my $value = $Alteon_syslog[$i];
               my ($timelist,$host,$IP,$program,$level,$content)=split(/\,/,$value);
               # For A3408-Fetion-FLB must be "real serv"
               next if ( $host !~ /-FLB-/ && $content =~ /real serv/ );
               my $loggentime=(split(/\s+/,$timelist))[2];
               my $ckey;
               my $isckey=0;

               for (my $i=0;$i<@Alteon_keywords;$i++){
                    $ckey = $Alteon_keywords[$i];
                    if ($program =~ m/$ckey/ || $content =~ m/$ckey/){
                        $isckey = 1;
                        last;
                    }
               }

               $ckey = 'other' if $isckey==0;

               if ($ckey eq 'other'){
                    push(@content_other,"$loggentime,$host,$IP,$program,$level,$content");
               }
            }
        }


        if (scalar(@Other_syslog)>0){
            for ( my $i=0;$i<@Other_syslog;$i++) {
               my $value = $Other_syslog[$i];
	       #print $value."\n";
               my ($timelist,$host,$IP,$program,$level,$content)=split(/\,/,$value);
               my $loggentime=(split(/\s+/,$timelist))[2];
               my $ckey;
               my $isckey=0;

	       foreach my $key (keys %Hash_All_keywords)
               {
                    $ckey = $key;
                    if ($program =~ m/$ckey/ || $content =~ m/$ckey/){
                        $isckey = 1;
                        last;
                    }
               }

               $ckey = 'other' if $isckey==0;

               if ($ckey eq 'other'){
                    push(@content_other,"$loggentime,$host,$IP,$program,$level,$content");
               }

            }
        }

        my $log_total = @FW_syslog + @SR_syslog + @F5_syslog + @A10_syslog + @Alteon_syslog + @Other_syslog;

        return $log_total;
}


### place all kinds of logs on array
### __START__
#
sub FireWall
{
        my ($IP,$host,$logfile) = @_;
        my $count=0;
        open(FID, "<$logfile") or die "can't open file $logfile";
        while(<FID>){;
                chomp;
                $count+=1;
		$_ =~ s/[\,\;\"]/\ /g;
		next if $_ =~ m/LOGIN|LOGOUT|Logoff|SHELL|admin|SSH/;
                next if $_ =~ /regular translation creation/;
                next if $_ =~ /No matching connection/;
		next if $_ =~ /Teardown/;
                my @temp = split(/\s+/,$_);
                my $content;
                my $timestamp = $temp[0]." ".$temp[1]." ".$temp[2];
                for(my $i=4;$i<@temp;$i++){
                    $content .= " ".$temp[$i];
                }
                $content =~ s/^\s+|\s+$//g;
                if ( $content =~ /(.*?)\s?(\w+(-\w+){1,4})?\s?\%?\%?(\w+[-\/]([0-7])[-\/]\w+(\(\w+\))?):?\s?(.*)/ ) {
                        push (@FW_syslog, "$timestamp,$host,$IP,$4,$5,$7");
                }else{
                        &speciallog('BadFW',$host,$content);
                }
        }
        return $count;
}

sub Switch_Router
{
        my ($IP,$host,$logfile) = @_;
        my $count=0;
        open(FID, "<$logfile") or die "can't open file $logfile";
        while(<FID>){;
                chomp;
                $count+=1;
                $_ =~ s/[\,\;\"]/\ /g;
		my @temp = split(/\s+/,$_);
		my $content;
		my $timestamp = $temp[0]." ".$temp[1]." ".$temp[2];
		for(my $i=4;$i<@temp;$i++){
		    $content .= " ".$temp[$i];
		}
		$content =~ s/^\s+|\s+$//g;
                if ( $content =~ /(.*?)\s?(\w+(-\w+){1,4})?\s?\%?\%?(\w+[-\/]([0-7])[-\/]\w+(\(\w+\))?):?\s?(.*)/ ) {
			push (@SR_syslog, "$timestamp,$host,$IP,$4,$5,$7");
		}else{
			&speciallog('BadSR',$host,$content);
                }
        }
        return $count;
}

sub F5
{
        my ($IP,$host,$logfile) = @_;
	my $count=0;
        open(FID, "<$logfile") or die "can't open file $logfile";
        while(<FID>){;
                chomp;
		$count+=1;
                $_ =~ s/[\,\;\"]/\ /g;
                my @temp = split(/\s+/,$_);
                my $content;
                my $timestamp = $temp[0]." ".$temp[1]." ".$temp[2];
                for(my $i=4;$i<@temp;$i++){
                    $content .= " ".$temp[$i];
                }
                $content =~ s/^\s+|\s+$//g;
                if ( $content =~ /(.*?)\s?\w+(-\w+){1,4}\s+(.*?):\s+(.*)/ ) {
                        push (@F5_syslog, "$timestamp,$host,$IP,$3,'6',$4");
                }else{
			&speciallog('BadF5',$host,$content);
                }
	}
	return $count;
}

sub A10
{
        my ($IP,$host,$logfile) = @_;
        my $count=0;
        open(FID, "<$logfile") or die "can't open file $logfile";
        while(<FID>){;
                chomp;
                $count+=1;
                $_ =~ s/[\,\;\"]/\ /g;
                my @temp = split(/\s+/,$_);
                my $content;
                my $timestamp = $temp[0]." ".$temp[1]." ".$temp[2];
                for(my $i=4;$i<@temp;$i++){
                    $content .= " ".$temp[$i];
                }
                $content =~ s/^\s+|\s+$//g;
        	if ( $content =~ /(.*?)\s?(a10logd:\s+\[\w+\])<([0-7])>\s+(.*)/ ) {
                        my $program=$2;
                        my $leftcontent=$4;
        	        my $level=$3;
        	        $program=~s/\s+/\-/g;
        	        $program=~s/\://g;
        	        $program=~s/\[|\]//g;
        	        $program=~s/\<|\>//g;
        	        #print "A10:".$host.",".$program.",".$level.",".$leftcontent."\n";
        	        push (@A10_syslog, "$timestamp,$host,$IP,$program,$level,$leftcontent");
        	}else{
			&speciallog('BadA10',$host,$content);
                }
	}
	return $count;
}

sub Alteon
{
        my ($IP,$host,$logfile) = @_;
        my $count=0;
        open(FID, "<$logfile") or die "can't open file $logfile";
        while(<FID>){;
                chomp;
                $count+=1;
                $_ =~ s/[\,\;\"]/\ /g;
                my @temp = split(/\s+/,$_);
                my $content;
                my $timestamp = $temp[0]." ".$temp[1]." ".$temp[2];
                for(my $i=4;$i<@temp;$i++){
                    $content .= " ".$temp[$i];
                }
                $content =~ s/^\s+|\s+$//g;
                if ( $content =~ /(\w+)\s+(AlteonOS\s+<\w+>):\s+(.*)/ ) {
                        my $level=$1;
                        $level =~ s/\s+//g;
			my $leftcontent=$3;
                        my $program=$2;
                        $program=~s/\s+/\-/g;
                        $program=~s/\://g;
                        $program=~s/\[|\]//g;
                        $program=~s/\<|\>//g;
                        #print "Alteon:".$host.",".$program.",".$level.",".$leftcontent."\n";
                        push (@Alteon_syslog, "$timestamp,$host,$IP,$program,$level,$leftcontent");
                }else{
			&speciallog('BadAlteon',$host,$content);
                }
        }
        return $count;
}

sub Otherone
{
        my ($IP,$host,$logfile) = @_;
        my $count=0;
        open(FID, "<$logfile") or die "can't open file $logfile";
        while(<FID>){;
                chomp;
                $count+=1;
                $_ =~ s/[\,\;\"]/\ /g;
                my @temp = split(/\s+/,$_);
                my $content;
                my $timestamp = $temp[0]." ".$temp[1]." ".$temp[2];
                for(my $i=4;$i<@temp;$i++){
                    $content .= " ".$temp[$i];
                }
                $content =~ s/^\s+|\s+$//g;
                push (@Other_syslog, "$timestamp,$host,$IP,Undefined,6,$content");
		&speciallog('BadOtherone',$host,$content);
	}
	return $count;
}
#
### place all kinds of logs on array
### __END__


### print it to screen or sendmail
### __START__
#
sub FireWall_echo
{
    my $MailContent = '';
    my $hash_lvl_tcnt;my %hash_lvl_tcnt;
    foreach my $key1 (keys %$hash)
    {
        foreach my $key2 (keys %{$hash->{$key1}})
        {
            foreach my $key3 (keys %{$hash->{$key1}{$key2}})
            {
                $hash_lvl_tcnt->{$key1}{$key2} += $hash->{$key1}{$key2}{$key3};
            }
        }
    }
    
    my %hash_host_tlvl;
    foreach my $key1 (keys %$hash_lvl_tcnt)
    {
        foreach my $key2 (keys %{$hash_lvl_tcnt->{$key1}})
        {
            #print $hash_lvl_tcnt->{$key1}{$key2}."\n";
            $hash_host_tlvl{$key1} += $hash_lvl_tcnt->{$key1}{$key2};
        }
    }
    
    #my $log_total;
    #foreach my $key (keys %hash_host_tlvl)
    #{
    #    $log_total += $hash_host_tlvl{$key};
    #}
    
    while ( my($key1, $value1) = each(%$hash) )
    {
        my $host = $key1;
        #print "\n".$host."\n";
        $MailContent .= "\n".$host." (:$hash_host_tlvl{$host})\n";
    
        while ( my($key2, $value2) = each(%$value1))
        {
            my $level = $key2;
            my $turnlevel = $priority{$level};
            my $hblankline = " " x length($host);
            #print $hblankline."|\n";
            #print $hblankline."|_ ".$level."\n";
            $MailContent .= $hblankline."|\n";
            $MailContent .= $hblankline."|_ ".$level."[$turnlevel]"." (:$hash_lvl_tcnt->{$host}{$level})\n";
    
            foreach my $key3 (sort keys %$value2)
            {
                my $content_name = $key3;
                my $lblankline = " " x (length($level)+2);
                my $content_value = $hash->{$key1}{$key2}{$content_name};
                #print $hblankline.$lblankline."|_ ".$content_name." =>\t".$content_value."\n";
                $MailContent .= $hblankline.$lblankline."|_ ".$content_name." \t=>\t".$content_value."\n";
                &optlevel2($host,$turnlevel,$content_name,$content_value);
            }
        }
    
    }
    $MailContent .= "\n";

    $MailContent .= "IP Deny list [top 20]:\n";
    my @sorted = map { { ($_ => $hashIP{$_}) } } sort {$hashIP{$b}<=>$hashIP{$a}} keys %hashIP;
    my $flag=1;
    foreach my $hashref (@sorted) {
      $flag+=1;
      if ($flag<=21) {
            my ($key, $value) = each %$hashref;
            #print "$key => $value\n";
	    if ($key =~ m/deny|denied/i){
                $MailContent .= "$key => $value\n";
                &optdenyip($key,$value);
	    }
      }else{
            last;
      }
    }

    $MailContent .= "\n";

    return $MailContent;
}

sub undefined_echo
{
    my $MailContent = "Undefine keywords:\n";
    if ( scalar(@content_other) > 0)
    {
        for(my $i=0;$i<@content_other;$i++) {
            $MailContent_other .="$content_other[$i]\n";
            &optlevel1($content_other[$i]);
        }
        $MailFlag=1;
    }else{
        $MailContent_other .= "NULL\n";
    }
    $MailContent .= $MailContent_other."\n";
    return $MailContent;
}
#
### print it to screen or sendmail
### __END__



### define output style
### __START__
#
sub optlevel1 {
    my $value = shift;
    open(OUTLEV1, ">>$outdir/syslog_level1_stat_$date") or die "can't open file $outdir/syslog_level1_stat_$date";
    my ($loggentime,$host,$IP,$program,$level,$content) = split(/\,/,$value);
    chomp $content;
    $loggentime = "$date $loggentime";
    my $keyword = 'other';
    print OUTLEV1 "$loggentime,$host,$IP,$program,$level,$keyword,$content\n";
    close OUTLEV1;

    open(ONLYLEV1, ">>$log_takeoff_level2") or die "can't open file $log_takeoff_level2";
    print ONLYLEV1 "$loggentime $IP $host $program $level $content\n";
    close ONLYLEV1;

    if ( $level =~ /^\d+$/ ) {
        $level = $priority{$level};
    }else{
        $level = lc($level);
        $level = "err" if $level eq "error";
    }
    &database_level1($loggentime,$host,$IP,$program,$level,$keyword,$content) if ($content ne ' ' || $content ne '');
}

sub optlevel2 {
    my ($hostname,$level,$content_name,$content_account) = @_;
    my $host = (split(/\_/,$hostname))[0];
    my $ip = (split(/\_/,$hostname))[1] ||$host;
    open(OUTLEV2, ">>$outdir/syslog_level2_stat_$date") or die "can't open file $outdir/syslog_level2_stat_$date";
    print OUTLEV2 "$host,$ip,$level,$content_name,$content_account\n";
    close OUTLEV2;
}

sub optdenyip {
    my ($host_level_ip,$value) = @_;
    chomp $value;
    my $host = (split(/\_/,$host_level_ip))[0];
    my $level = (split(/\_/,$host_level_ip))[1];
    my $ip = (split(/\_/,$host_level_ip))[2];
    open(OUTDENY, ">>$outdir/syslog_deny_stat_$date") or die "can't open file $outdir/syslog_deny_stat_$date";
    print OUTDENY "$host,$ip,$level,$value\n";
    close OUTDENY;
}
#
### __END__
### define output style


### write database
### __START__
#
sub database_level1 {
        my ($loggentime,$host,$IP,$program,$level,$keywords,$content) = @_;
        chomp $content;
        my $table_name = "logs";
        my $columns = '`host`,`ip`,`facility`,`priority`,`level`,`program`,`tag`,`msg`,`fo`';
        my $values = "\"$host\",\"$IP\",\"syslog\",\"$level\",\"$level\",\"$program\",\"$keywords\",\"$content\",\"$loggentime\"";
        # Write to mysql database
        ## write level1 data
        my $string = "INSERT INTO $table_name ( $columns ) value ( $values )";
        #print $string."\n";
        my $sth=$dbh->do(qq{INSERT INTO $table_name ( $columns ) value ( $values )});
	#open(PIPE, ">>/tmp/mysql.pipe");
	#print PIPE $string."\n";
	#close PIPE;
        return $string;
}
#
### __END__
### write database


### define inner filter
### __START__
#
sub SW_addition
{
	my ($host,$line) = @_;
        # devide for bottom layer switch UP&DOWN
        my $updownflag = 0;
	my $switchflag = 0;
        my $swport;
        if ($line =~ /UP|DOWN|change/i){
	    if ($line =~ /(GigabitEthernet\d+\/\d+\/?\d?)/){
                $updownflag = 1;
                $swport = $1;
	        #print "swportcontent: $swport\n";
	    }elsif($line =~ /(M-Ethernet)/){
                $updownflag = 1;
                $swport = $1;
                #print "swportcontent: $swport\n";
	    }
        }
        # switch compare
        if ( $updownflag == 1 ){
            $switchflag=&SW_compare($host,$swport);
            if ( $switchflag == 1 ) {
                return 1;
            }else{
                return 0;
            }
        }else{
	    return 1;
	}
}

sub SW_compare{
    my ( $hostname, $swport ) = @_;
    my @found=grep(/$hostname\s$swport/,@SWITCH);
    if(@found>=1){
        return 1;
    }else{
        return 0;
    }
}
#
### __END__
### define inner filter


sub sendmail{
        my $MailFrom = 'report@syslog.feinno.com';
        my ($MailTo,$MailFlag,$MailSubject,$MailContent) = @_;
        if ($MailFlag == 1) {
                $MailFlag = "X-Priority: 1 (Highest)\n";
                $MailFlag .= "X-MSMail-Priority: High\n";
                $MailFlag .= "Importance: High\n";
        }else{
                $MailFlag = "";
        }
        open(FD,"|/usr/sbin/sendmail -fadmin -t>/dev/null") || die "sendmail fail! $!\n";
        print FD "To:$MailTo\n";
        print FD "From:$MailFrom\n";
        print FD "Subject:$MailSubject\n";
        print FD "$MailFlag\n";
        print FD "$MailContent";
        close(FD);
}

sub conv_date_tostr {
    my $ts = shift;
    #my ($sec,$min,$hour,$mday,$mon,$year) = localtime($ts);
    #my $timestamp = timelocal($sec,$min,$hour,$mday,$mon,$year);
    #sprintf "time used: %.3fs",$timestamp;
    sprintf("time used: %.3fs", $ts);
}

sub speciallog {
    my ($flag,$host,$logline) = @_;
    open(SPECIAL, ">>$outdir/${flag}_$host");
    print SPECIAL "$logline\n";
    close SPECIAL;
    #print "$flag $host: $logline\n";
}
